SSH Connection Failures on FIPS-Enabled vCenter Server Appliance

Products

• VMware vCenter Server

Issue/Introduction

• The SSH client (e.g., older versions of TeraTerm or PuTTY) closes the session immediately after the connection attempt
• System logs on the VCSA (/var/log/vmware/messages) display the following entries upon service startup and connection attempt:
  

  sshd[PID]: FIPS mode initialized
  sshd[PID]: Received disconnect from [Client_IP]:11: authentication cancelled [preauth]
  sshd[PID]: Disconnected from [Client_IP] [preauth]

  
  
  

Environment

VMware vCenter Server 7.x

VMware vCenter Server 8.x

Cause

When FIPS mode is enabled on vCenter, SSH connections are rejected if the client software is outdated or does not support FIPS-compliant cryptography.

Resolution

Update the SSH client to the latest available version.
Modern versions of SSH clients (TeraTerm, PuTTY, OpenSSH) are regularly updated to support the latest cryptographic standards, including FIPS-compliant cipher suites.